@ccoalm/ccl-skills 0.18.5 → 0.18.7

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_cli_review_wrappers.sh

@@ -64,6 +64,9 @@ base_url = "https://example.invalid"
 [future_tools]
 enabled = true
 
+[watch]
+enabled = true
+
 [permission]
 deny = ["Read"]
 
@@ -164,6 +167,7 @@ cat >"$WORK/bin/kimi" <<'KIMI_STUB'
 #!/usr/bin/env bash
 set -u
 state="$REVIEW_WRAPPER_TEST_STATE"
+printf '%s\t%s\n' invocation "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch_all"
 if [ "${1:-}" = --version ]; then
   if [ "${STUB_BEHAVIOR:-}" = version_hang ]; then
     trap '' TERM
@@ -176,6 +180,23 @@ fi
 if [ "${1:-}" = doctor ]; then
   touch "$state/kimi_doctor_checked"
   printf '%s\n' "$*" >"$state/kimi_doctor_args"
+  printf '%s\t%s\n' doctor "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch"
+  # Keep every validated config so a retry can be compared against the attempt
+  # it replaced, rather than only asserted about one property at a time.
+  doctor_n=$(( $(cat "$state/kimi_doctor_count" 2>/dev/null || echo 0) + 1 ))
+  printf '%s' "$doctor_n" >"$state/kimi_doctor_count"
+  if [ -n "${3:-}" ] && [ -f "$3" ]; then
+    cp "$3" "$state/kimi_doctor_config.$doctor_n"
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = doctor_reject_all ]; then
+    printf '%s\n' 'config rejected' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = doctor_reject_watch ] \
+    && [ -n "${3:-}" ] && [ -f "$3" ] && grep -q '^\[watch\]' "$3"; then
+    printf '%s\n' 'unknown config table: watch' >&2
+    exit 1
+  fi
   exit 0
 fi
 touch "$state/kimi_invoked"
@@ -199,6 +220,12 @@ while [ "$#" -gt 0 ]; do
     *) shift ;;
   esac
 done
+if [[ "$prompt" = "No-tools capability probe."* ]]; then
+  watch_phase=capability
+else
+  watch_phase=formal
+fi
+printf '%s\t%s\n' "$watch_phase" "${KIMI_CODE_WATCH-}" >>"$state/kimi_watch"
 printf '%s' "$has_stream" >"$state/kimi_stream"
 printf '%s' "$has_model" >"$state/kimi_model_override"
 printf '%s' "$has_skills_dir" >"$state/kimi_skills_dir"
@@ -213,7 +240,9 @@ if [ -f "$KIMI_CODE_HOME/config.toml" ]; then
   grep -q '/trusted/local/hook-marker' "$KIMI_CODE_HOME/config.toml" && touch "$state/kimi_hooks_preserved"
   grep -q 'enabled = \["\*"\]' "$KIMI_CODE_HOME/config.toml" \
     && touch "$state/kimi_no_tools_configured"
-  python3 - "$KIMI_CODE_HOME/config.toml" "$state/kimi_runtime_config_mode" "$state/kimi_dotted_config_preserved" <<'PY'
+  grep -c '^# Generated by code-review' "$KIMI_CODE_HOME/config.toml" \
+    >"$state/kimi_generated_marker_count"
+  python3 - "$KIMI_CODE_HOME/config.toml" "$state/kimi_runtime_config_mode" "$state/kimi_dotted_config_preserved" "$state/kimi_watch_disabled" "$state/kimi_watch_absent" <<'PY'
 import os, sys, tomllib
 from pathlib import Path
 
@@ -222,6 +251,10 @@ with open(sys.argv[2], "w", encoding="utf-8") as stream:
 config = tomllib.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
 if config.get("providers") and config.get("models"):
     Path(sys.argv[3]).touch()
+if config.get("watch") == {"enabled": False}:
+    Path(sys.argv[4]).touch()
+if "watch" not in config:
+    Path(sys.argv[5]).touch()
 PY
 fi
 if [ -f "$KIMI_CODE_HOME/mcp.json" ]; then
@@ -258,6 +291,58 @@ if [[ "$prompt" = "No-tools capability probe."* ]]; then
     printf '%s\n' 'EMFILE: too many open files, watch' >&2
     exit 1
   fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_quota ]; then
+    printf '%s\n' "provider.auth_error: 403 You've reached your weekly (7-day) usage limit" >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_quota_mention ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; quota metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_limit ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; usage limit metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_word ]; then
+    printf '%s\n' 'tool surface rejected; authentication metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_offset ]; then
+    printf '%s\n' 'provider failed at byte offset 4290 and line 14030' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_exact_offset ]; then
+    printf '%s\n' 'provider failed at byte offset 429 and line 403' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_rate_limit_403 ]; then
+    printf '%s\n' 'provider.auth_error: 403 rate limit exceeded' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_http_quota ]; then
+    printf '%s\n' 'provider error: HTTP 429 Too Many Requests' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_decode_offset ]; then
+    printf '%s\n' 'provider failed to decode offset 429' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_weekly_metadata ]; then
+    printf '%s\n' 'provider.auth_error: 403 authentication required; weekly usage limit metadata unavailable' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_auth_too_many ]; then
+    printf '%s\n' 'provider.auth_error: HTTP 429 Too Many Requests' >&2
+    exit 1
+  fi
+  if [ "${STUB_BEHAVIOR:-pass}" = capability_forbidden ]; then
+    printf '%s\n' 'provider error: 403 Forbidden' >&2
+    exit 1
+  fi
   if [ "${STUB_BEHAVIOR:-pass}" = capability_missing ]; then
     printf '%s\n' '{"role":"meta","type":"system.version","version":"future"}'
     exit 0
@@ -546,6 +631,7 @@ content = {
     "foreign_tool": clean,
     "nested_tool": clean,
     "unknown_event": clean,
+    "doctor_reject_watch": clean,
     "multi_message": clean,
     "mcp_bad_chunk": clean,
     "mcp_eof_confirmation": clean,
@@ -1321,15 +1407,37 @@ for client in kimi codex; do
   done
 done
 
-out="$(run_kimi pass)"; rc=$?
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled"
+out="$(KIMI_CODE_WATCH=1 run_kimi pass)"; rc=$?
 check "Kimi clean result passes with fixed Moonshot attribution" \
-  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(field concern_results.0.concern "$out")" = correctness ] && [ "$(field reviewer_family "$out")" = moonshot ] && [ "$(field provider "$out")" = kimi-cli ] && [ "$(field model "$out")" = None ] && [ "$(dir_mode "$WORK/kimi-source/config.toml")" = 400 ] && [ "$(cat "$WORK/state/kimi_runtime_config_mode")" = 600 ]'
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ "$(field concern_results.0.concern "$out")" = correctness ] && [ "$(field reviewer_family "$out")" = moonshot ] && [ "$(field provider "$out")" = kimi-cli ] && [ "$(field model "$out")" = None ] && [ "$(dir_mode "$WORK/kimi-source/config.toml")" = 400 ] && [ "$(cat "$WORK/state/kimi_runtime_config_mode")" = 600 ] && [ "$(wc -l < "$WORK/state/kimi_watch" | tr -d " ")" = 3 ] && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all" && [ -e "$WORK/state/kimi_watch_disabled" ]'
+# The retry's config must differ from the attempt it replaced by exactly the
+# watcher table: asserting only that watch is absent would also pass a retry
+# that dropped or widened something else.
+retry_config_is_watch_only_delta() {
+  python3 -c '
+import sys
+first = open(sys.argv[1], encoding="utf-8").read()
+retry = open(sys.argv[2], encoding="utf-8").read()
+sys.exit(0 if first.replace("[watch]\nenabled = false\n", "", 1) == retry else 1)
+' "$1" "$2"
+}
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled" "$WORK/state/kimi_watch_absent" "$WORK/state/kimi_doctor_count" "$WORK/state/kimi_doctor_config."*
+out="$(KIMI_CODE_WATCH=1 run_kimi doctor_reject_watch)"; rc=$?
+# The watcher guard is belt on top of the per-invocation override, which the
+# runtime reads ahead of the config. A runtime that does not know the table may
+# not cost the whole lane: drop the table, keep the override, stay admitted.
+check "Kimi keeps the lane when the runtime rejects only the watcher table" \
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ -e "$WORK/state/kimi_watch_absent" ] && [ ! -e "$WORK/state/kimi_watch_disabled" ] && [ "$(tr -d " " < "$WORK/state/kimi_generated_marker_count")" = 1 ] && retry_config_is_watch_only_delta "$WORK/state/kimi_doctor_config.1" "$WORK/state/kimi_doctor_config.2" && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 2 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all"'
+out="$(run_kimi doctor_reject_all)"; rc=$?
+check "Kimi still fails closed when no generated config is accepted" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_packet_only_config_unrecognized ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
 # Admission is version-neutral: deliberately unparseable version output must not
 # trigger --version or block a capable runtime.
-rm -f "$WORK/state/kimi_invoked" "$WORK/state/kimi_version_checked" "$WORK/state/kimi_no_tools_configured" "$WORK/state/kimi_no_tools_policy_verified"
+rm -f "$WORK/state/kimi_invoked" "$WORK/state/kimi_version_checked" "$WORK/state/kimi_no_tools_configured" "$WORK/state/kimi_no_tools_policy_verified" "$WORK/state/kimi_watch_all"
 out="$(KIMI_STUB_VERSION='not-a-version' run_kimi pass)"; rc=$?
 check "Kimi admission depends on runtime capability, not a version string" \
-  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ ! -e "$WORK/state/kimi_version_checked" ] && [ -e "$WORK/state/kimi_doctor_checked" ] && grep -q "^doctor config /.*config.toml$" "$WORK/state/kimi_doctor_args" && [ -e "$WORK/state/kimi_invoked" ] && [ -e "$WORK/state/kimi_no_tools_configured" ] && [ -e "$WORK/state/kimi_no_tools_policy_verified" ]'
+  '[ "$rc" = 0 ] && [ "$(field status "$out")" = passed ] && [ ! -e "$WORK/state/kimi_version_checked" ] && [ -e "$WORK/state/kimi_doctor_checked" ] && grep -q "^doctor config /.*config.toml$" "$WORK/state/kimi_doctor_args" && [ -e "$WORK/state/kimi_invoked" ] && [ -e "$WORK/state/kimi_no_tools_configured" ] && [ -e "$WORK/state/kimi_no_tools_policy_verified" ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all"'
 rm -f "$WORK/state/kimi_invoked"
 out="$(run_kimi pass claude "$WORK/kimi-source" "$WORK/nul.patch")"; rc=$?
 check "Kimi rejects a NUL-bearing diff before inference" \
@@ -1346,6 +1454,47 @@ check "Kimi rejects any tool exposed during the no-tools probe" \
 out="$(run_kimi capability_emfile)"; rc=$?
 check "Kimi classifies probe-time EMFILE as a local client failure" \
   '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_host_resource_exhausted ] && [ "$(field reason_code "$out")" = client_unavailable ] && [ "$(field cascade_eligible "$out")" = True ]'
+# Provider prose is not sub-classified: these shapes each broke a predecessor
+# predicate, and all of them now land in the one capability class.
+out="$(run_kimi capability_quota)"; rc=$?
+check "Kimi does not sub-classify provider prose: quota" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_quota_mention)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth quota mention" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_limit)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth limit" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_word)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth word" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_exact_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: exact offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_rate_limit_403)"; rc=$?
+check "Kimi does not sub-classify provider prose: rate limit 403" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_http_quota)"; rc=$?
+check "Kimi does not sub-classify provider prose: http quota" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_forbidden)"; rc=$?
+check "Kimi does not sub-classify provider prose: forbidden" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_decode_offset)"; rc=$?
+check "Kimi does not sub-classify provider prose: decode offset" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_weekly_metadata)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth weekly metadata" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
+out="$(run_kimi capability_auth_too_many)"; rc=$?
+check "Kimi does not sub-classify provider prose: auth too many" \
+  '[ "$rc" = 2 ] && [ "$(field reason "$out")" = kimi_tool_capability_unverified ] && [ "$(field reason_code "$out")" = capability_missing ] && [ "$(field cascade_eligible "$out")" = True ] && [ "$(field transport_exit_code "$out")" = 1 ]'
 probe_started=$SECONDS
 out="$(REVIEW_TEST_TIMEOUT=5 run_kimi capability_hang)"; rc=$?
 probe_elapsed=$((SECONDS - probe_started))
@@ -1406,10 +1555,13 @@ out="$(REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin"
 check "Kimi caps argv-exposed inline review at 120 seconds" \
   '[ "$rc" = 0 ] && grep -q -- "--kill-after=1s 120s " "$WORK/state/timeout_args"'
 rm -f "$WORK/state/timeout_args"
-out="$(REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi pass claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
+rm -f "$WORK/state/kimi_watch" "$WORK/state/kimi_watch_all" "$WORK/state/kimi_watch_disabled"
+out="$(KIMI_CODE_WATCH=1 REVIEW_TEST_TIMEOUT=180 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi pass claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
 formal_timeout="$(tail -n 1 "$WORK/state/timeout_args" | awk '{ value=$2; sub(/s$/, "", value); print value }')"
 check "Kimi gives private MCP review only the remaining controller budget" \
   '[ "$rc" = 0 ] && [ "$formal_timeout" -ge 1 ] && [ "$formal_timeout" -le 180 ]'
+check "Kimi sets the watcher override on private MCP formal delivery" \
+  '[ "$(wc -l < "$WORK/state/kimi_watch" | tr -d " ")" = 3 ] && [ "$(grep -c "^doctor[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^capability[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(grep -c "^formal[[:space:]]0$" "$WORK/state/kimi_watch")" = 1 ] && [ "$(wc -l < "$WORK/state/kimi_watch_all" | tr -d " ")" = 3 ] && ! grep -qEv "^invocation[[:space:]]0$" "$WORK/state/kimi_watch_all" && [ -e "$WORK/state/kimi_watch_disabled" ]'
 rm -f "$WORK/state/timeout_args"
 out="$(REVIEW_TEST_TIMEOUT=10 REVIEW_TEST_PATH_PREFIX="$WORK/timeout-probe-bin" run_kimi capability_delay claude "$WORK/kimi-source" "$WORK/agent-template.patch")"; rc=$?
 formal_timeout="$(tail -n 1 "$WORK/state/timeout_args" | awk '{ value=$2; sub(/s$/, "", value); print value }')"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_client_compat.py

@@ -832,11 +832,49 @@ class CompletionFindingDispositionTest(unittest.TestCase):
                                             "failure_path": "A distinct synthetic failure on the same line."})
         return subprocess.CompletedProcess(command, 0, json.dumps(payload).encode("utf-8"), b"")
 
+    base_repo: Path | None = None
+
     def arguments(self, mode: str) -> list[str]:
-        return ["--mode", mode, "--cwd", str(self.root), "--diff-file", str(self.packet),
+        if self.base_repo is not None:
+            candidate = ["--cwd", str(self.base_repo), "--base", self.base_commit]
+        else:
+            candidate = ["--cwd", str(self.root), "--diff-file", str(self.packet)]
+        return ["--mode", mode, *candidate,
                 "--implementer-family", "openai", "--review-plan-file", str(self.plan),
                 "--challenge-budget", "1"]
 
+    def test_source_refuted_completion_records_a_passed_receipt(self) -> None:
+        # The chain the pull-request reminder reads: findings recorded on a
+        # committed whole-worktree candidate, then disposed through completion.
+        repo = self.root / "repo"
+        repo.mkdir()
+        def git(*command: str) -> str:
+            return subprocess.run(["git", "-C", str(repo), "-c", "user.email=t@example.invalid",
+                             "-c", "user.name=t", *command],
+                            capture_output=True, check=True, text=True).stdout.strip()
+        git("init", "-q")
+        (repo / "x").write_text("a\n", encoding="utf-8")
+        git("add", "x")
+        git("commit", "-q", "-m", "base")
+        self.base_commit = git("rev-parse", "HEAD")
+        (repo / "x").write_text("b\n", encoding="utf-8")
+        git("commit", "-q", "-am", "candidate")
+        head = git("rev-parse", "HEAD")
+        self.base_repo = repo
+        self.record_receipts()
+        receipt = repo / ".git" / "ccl-code-review" / "last-review.json"
+        before = json.loads(receipt.read_text(encoding="utf-8"))
+        self.assertEqual((before["mode"], before["status"], before["head"], before["worktree_clean"]),
+                         ("challenge", "findings", head, True))
+
+        code, result = self.complete()
+
+        self.assertEqual(code, 0, result)
+        self.assertEqual(result["status"], "passed", result)
+        after = json.loads(receipt.read_text(encoding="utf-8"))
+        self.assertEqual((after["mode"], after["status"], after["head"], after["worktree_clean"]),
+                         ("complete", "passed", head, True))
+
     def invoke(self, mode: str, extra: list[str]) -> tuple[int, dict]:
         output = io.StringIO()
         with (mock.patch.object(review_gate, "run", side_effect=self.wrapper_result),

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -4182,10 +4182,38 @@ module.signal_reviewer_process_group(
 )
 tree_process.communicate(timeout=2)
 tree_child_gone = False
-for _ in range(100):
+# The killed grandchild is reparented to PID 1. Where PID 1 never reaps
+# orphans (some containers), it stays a zombie that still answers signal 0,
+# so a zombie counts as gone: it has exited and holds no pipe or lock.
+def exited(pid):
     try:
-        module.os.kill(tree_child_pid, 0)
+        module.os.kill(pid, 0)
     except ProcessLookupError:
+        return True
+    try:
+        with open(f"/proc/{pid}/stat", encoding="utf-8") as stat:
+            return stat.read().rsplit(")", 1)[1].split()[0] == "Z"
+    except FileNotFoundError:
+        # procfs may be absent (macOS), or the PID may have exited between
+        # probes. Only a second failed liveness check proves the latter.
+        try:
+            module.os.kill(pid, 0)
+        except ProcessLookupError:
+            return True
+        return False
+    except OSError:
+        return False
+from unittest.mock import patch, mock_open
+# Negative control: a live PID must remain live even on hosts without procfs.
+assert not exited(module.os.getpid())
+with patch("builtins.open", side_effect=FileNotFoundError):
+    assert not exited(module.os.getpid()), "missing procfs is not process-exit evidence"
+with patch.object(module.os, "kill", side_effect=ProcessLookupError):
+    assert exited(42), "a missing PID must count as exited without relying on PID reuse timing"
+with patch.object(module.os, "kill"), patch("builtins.open", mock_open(read_data="42 (worker) Z 1")):
+    assert exited(42), "a Linux zombie has exited even when signal 0 succeeds"
+for _ in range(100):
+    if exited(tree_child_pid):
         tree_child_gone = True
         break
     time.sleep(0.01)
@@ -4863,6 +4891,24 @@ out="$(REVIEW_GATE_TEST_STATE="$WORK/state" "$WORK/harness/scripts/review_gate.s
 check "a bare --diff-file review records no receipt" \
   '[ "$rc" = 0 ] && json_fields "$out" status=passed && [ ! -e "$contract_repo/.git/ccl-code-review" ]'
 
+# The completion checkpoint is what the pull-request reminder reads as disposed:
+# on the same whole-worktree candidate it replaces the review's receipt with a
+# passed one; a checkpoint that fails leaves the receipt as it was.
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode review)"; rc=$?
+printf '%s\n' "$out" >"$WORK/contract-completion-review.json"
+check "the review before a completion checkpoint records its own receipt" \
+  '[ "$rc" = 0 ] && [ "$(jq -r .mode "$receipt_file")" = review ]'
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode complete --completion-review-result-file "$WORK/contract-completion-review.json")"; rc=$?
+check "a successful completion checkpoint records a passed receipt for the HEAD it bound" \
+  '[ "$rc" = 0 ] && json_fields "$out" mode=complete status=passed && [ "$(jq -r .mode "$receipt_file")" = complete ] && [ "$(jq -r .status "$receipt_file")" = passed ] && [ "$(jq -r .head "$receipt_file")" = "$(git -C "$contract_repo" rev-parse HEAD)" ]'
+cp "$receipt_file" "$WORK/receipt-before-failed-completion"
+reset_case passed unavailable unavailable
+out="$(run_contract_gate --mode complete --review-plan-file "$WORK/changed-review-plan.json" --completion-review-result-file "$WORK/contract-completion-review.json")"; rc=$?
+check "a failed completion checkpoint leaves the receipt untouched" \
+  '[ "$rc" = 2 ] && cmp -s "$receipt_file" "$WORK/receipt-before-failed-completion"'
+
 swap_out="$(PYTHONPATH="$WORK/harness/scripts" python3 - "$WORK" <<'PY' 2>&1
 import os, sys, review_gate
 root = os.path.realpath(os.path.join(sys.argv[1], "gitdir-swap"))

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/SKILL.md

@@ -125,7 +125,7 @@ At each stage boundary, walk the per-stage entry-state enumeration in [Stage-Ent
      - **Changed candidate = refreshed row + fresh full-scope rerun** — any post-review change, tests/docs included, mechanically triggers a full-scope rerun; the author cannot narrow its scope or call the change immaterial.
      - **Independent gate surfacing basics = process defect** — repair the self-review/deterministic-gate loop before rerunning, and findings still require disposition, not waiver.
      - **Green-tests-alone merge is the same defect** as reaching implementation with only spec plus plan.
-     - **Human/team sign-off** — for high-risk money/permission/data paths and any contract/API change with an external consumer, before implementation, merge, or launch.
+     - **Human/team sign-off** — this gate alone: high-risk money/permission/data or breaking external APIs, before merge/launch, never before implementation. Explicit stricter rules still bind.
      - **Floor** — reaching implementation with only spec plus plan on triggered work is a process defect, not a shortcut.
    - For any multi-step request that combines assessment, fixes, and verification, produce a task plan before editing code (required fields in `references/delivery-lifecycle.md` §Plan Authoring).
    - **Concurrent-session isolation**: when more than one session/agent/work-line may edit the same repository, give each line its own `git worktree` (or separate clone) on a unique per-line branch before editing — never stash another line's uncommitted changes, host-install symlinks into shared repos count as shared-tree edits, if isolation was skipped do not commit unreviewed shared changes to dodge clobber, and run the pre-merge freshness gate before merging back (recipe: `worktree-isolation`; mechanics: `references/worktree-mechanics.md`).
@@ -164,8 +164,8 @@ At each stage boundary, walk the per-stage entry-state enumeration in [Stage-Ent
    - High-risk workflows cannot be accepted by happy-path tests alone. Require a risk scenario matrix and replayable incident drills for the relevant classes: duplicate money/quota/write side effects, permission uncertainty, tenant/user data isolation, AI provider/model failure, user repeated submission or unclear final state, and traceable incident explanation.
    - For UI backed by APIs or generated content, require `testing-strategy` to produce evidence that covers rendered states, contract/error handling, and one real visible flow where feasible. Do not let ideal mocked data stand in for runtime integration evidence.
    - When live infrastructure is required, keep it explicit and separate from default fast tests.
-   - After code/test edits, self-check and invoke `code-review` automatically before completion. Persist review status; timeout, empty output or inconclusive results remain pending, never passed.
-   - For independent review runs, prefer bounded diff/file input over broad repo prompts. Load the repository's local rules such as `AGENTS.md` or equivalent review context when available, skip generated/docs noise unless it is the review target, and make timeout/inconclusive results recoverable through a durable pending record.
+   - After code/test edits, deep self-review in the main agent; then, for external independent review, never a human one, invoke `code-review` automatically before completion. Persist review status; timeout, empty output or inconclusive results remain pending, never passed.
+   - Review runs take bounded diff input plus the repository's `AGENTS.md` or equivalent rules, skip generated/docs noise unless targeted, and keep timeout/inconclusive results in a durable pending record.
    - For product/spec normalization, standards-to-health-gate work, or any change that edits a shared deterministic gate/verifier (workspace verifier, conformance script, contract-coverage gate, status-source validator, CI harness, continuation-state checker, or a cross-repo contract/status/version/release/compatibility coordination surface), this workflow classifies the artifact before implementation — `spec/plan`, `gate design`, `gate implementation`, `status sync`, or `runtime/code` — without delegating that decision (do not delegate the spec-vs-plan-vs-code decision to `feature-risk-router`), then routes every shared-gate change through `feature-risk-router` and applies its `shared-gate` decision before shared branch push or MR merge; a recorded independent adversarial review names concrete objections, their disposition, and the reviewer/tool identity — prefer the session's review/challenge skill, otherwise a ccl-owned independent review (external tools supplement only; same-agent inline prose review only for explicitly low-risk, non-cross-boundary work). Rule/scope/failure/completion semantics changes require a concrete repo-local persistent artifact before editing; a `gate implementation` runs the plan/status verifier(s) before implementation and before claiming the plan active — an explicit status-source validator takes precedence, otherwise run every authoritative non-alias verifier or record why each is not applicable; a verifier gap or unavailable required review/challenge stays `interim` / pending-review. Details live in `references/shared-gate-artifact-classification.md`.
    - Do not use landing labels without matching evidence. `landed` requires the relevant local commit or persisted artifact; `MR-ready` requires branch, push, review artifact, known CI/pipeline status when applicable, known mergeability when applicable, and review status that matches reality; `release-ready` requires the relevant release checks, rollback/mitigation, and runtime verification evidence; `shared-status-ready` requires the owning status or product document to match the real branch/MR/review/verification state. For local-only or exploratory slices, report the actual uncommitted/unpushed state and use a local status label instead of treating MR evidence as mandatory.
    - When the delivery changes shared product status, roadmap, verification state, or cross-repository readiness, update the owning product/status document in the same delivery batch after the code MR lands. The **agent-consumed status-doc rule** is stricter: such a tracker is part of the work itself and must match the final handed-off/green/shared state — before merge and after reviewer edits/squash/rebase/platform merge, re-validate it against the final diff/ref/CI and point it at the final landed ref (`references/status-tracker-sync.md`).
@@ -187,13 +187,13 @@ At each stage boundary, walk the per-stage entry-state enumeration in [Stage-Ent
 
 ### Pre-Final Continuation Gate
 
-Run this gate before finalizing a product R&D turn after any delivery slice lands, on every user reply immediately following an assistant message that states or implies a next action, and on any explicit continuation request. The reply need not first be classified as assent. Recover the intended action from the current request and relevant conversation; a malformed or absent marker alone never selects `blocked:`. Report `continuing: <action and scope>` for the work you will execute, or `blocked: <action and scope> — <specific blocker>` when no authorized work can proceed. A blocked dependent action may remain pending while a different authorized action continues. Apply landing checks only to actual landing claims; an already-authorized local investigation does not require inventing a prior landing. Details: `references/pre-final-continuation-gate.md` (Gate triggers and outcome contract).
+Run this gate before finalizing a product R&D turn after any delivery slice lands, on every user reply immediately following an assistant message that states or implies a next action, and on any explicit continuation request. Recover the intended action from the current request and relevant conversation; a malformed or absent marker alone never selects `blocked:`. Report, on its own line, `continuing: <action and scope>` for work you will execute, or `blocked: <action and scope> — <specific blocker>` when no authorized work can proceed; `proposed-next:` never replaces it. A blocked dependent action may remain pending while a different authorized action continues. Apply landing checks only to actual landing claims; an already-authorized local investigation does not require inventing a prior landing. Details: `references/pre-final-continuation-gate.md` (Gate triggers and outcome contract).
 
 1. Confirm the landing state from real evidence (local branch, remote sync, MR/review artifact, CI/pipeline when applicable, review/challenge status when required, status-doc sync, dirty worktree), proving the landing before reading any document (for the remote-backed default, fetch/update the target ref from its remote immediately before classifying the slice landed) per `references/pre-final-continuation-gate.md` (Landing-state proof); content/tree/patch equivalence never by itself proves a slice landed.
 2. Inspect the current product/status source of truth, issue list, repo-local next-step artifact, unresolved acceptance item, or direct user continuation instruction for the next implied slice. **Reconcile it against the current branch/MR/merge/CI/tag state from step 1 before deriving: contradicting reality means stale — stop, repair the status source first, and do NOT derive from the stale source or a git-log/grep scan** (`references/pre-final-continuation-gate.md` §Status-source reconciliation).
    - **Deferred-evidence continuation check (`DFE-CONT`).** When real/runtime evidence is due (named by an acceptance item, status source, landing-evidence row, required gate, user correction, or because it is the behavior's only meaningful proof) yet deferred, blocked after remediation, skipped at finalization, or replaced by local/mock verification. Report deferred real evidence as `interim`/outstanding; do NOT report the turn complete while it is outstanding. A local/mock substitution is terminal only when a cited **non-agent** anchor — **agent-authored or agent-co-edited status/router/gate/handoff text never satisfies this** — names the same evidence, declares the deferral terminal, and carries the outstanding command/source forward for the active slice/ref. Never add verifier/config/test hardening motivated only by missing deferred evidence; never auto-continue past the pending gate. **Load `references/pre-final-continuation-gate.md` before treating any deferral as terminal** — it owns the valid/invalid-anchor list and hardening boundary.
    - **Affirmative-assent binding rule** lives in `references/pre-final-continuation-gate.md` §Assent binding — load it when recovering a short reply. Bind to the current explicit request or one recoverable concrete proposal, including an unmarked proposal; preserve its scope and existing authority. Ask only if action, scope, or required authority remains unresolved after recovery. A status remark or output marker cannot substitute for a proposal or permission; self-classifying the reply or marker away is never an exit from carrying out an already-clear request.
-3. Continue automatically with a clearly owned, verifiable, low-risk next slice from an explicit task/status/acceptance source or active user continuation, within accepted scope and existing authority. Apply the eligibility and stop conditions in `references/pre-final-continuation-gate.md`. Necessary fixes, tests and review inherit task authorization; a reviewer-budget flag triggers a method checkpoint and cumulative-history record, not renewed permission. Explicit user limits still govern. Existing configured internal developer-self-use metered model/tool accounts aren't an external purchase here.
+3. Continue an owned, verifiable, low-risk slice from the active task/status/acceptance source or user continuation, within scope and authority; apply `references/pre-final-continuation-gate.md`. Necessary fixes, tests and review inherit task authorization. Reviewer-budget flags require a method checkpoint and cumulative history, not renewed permission. Small tests and routine development/test-environment operations use configured access directly: no per-run approval or invented cost cap. Developer-self-use metered accounts are not new purchases; explicit user limits and high-impact boundaries still govern.
 4. Stop only for an explicit stop/pause instruction, a user-requested status-only answer, a concrete blocker for the affected action, or no safe authorized work remains. Block materially differing viable approaches (none dominant-and-reversible) and a fix lacking evidenced cause; load `references/pre-final-continuation-gate.md` for the full stop conditions. **Scope each blocker to its dependent action or claim.** An unproven cause blocks the speculative patch, not available diagnosis; a pending gate blocks dependent landing/completion, not authorized remediation or independent work. Before ending, perform in-scope diagnosis, owner discovery, remediation or independent work, and poll any finite step you started to its result, never reporting it as running. Quality-gate failures require diagnosis and available related behavior-preserving cleanup before escalation; preserve readability and compatibility, never game counters (`references/refactoring-discipline.md`). Never bypass the blocked gate, invent a pass, widen scope, or substitute unrelated hardening. With one dominant reversible approach and no applicable stop condition, do not stop at a recommendation: deliver a tested reviewable draft.
 5. If stopping, state the concrete stop reason and the exact evidence checked; an assent-triggered `blocked:` outcome uses the action/scope-plus-blocker form and classifies the turn `interim`. Ask one concise in-turn question when ambiguity or missing authority blocks; explicit stop/pause needs no reconfirmation. A `continuing:` outcome proceeds with the named slice before finalizing. A silent/completion stop is invalid. Do not send a completion-only, solved, fixed, or fully-closed final response after a merge/sync while a required review/challenge is pending or inconclusive; report interim or blocked with the next unblock step.
 6. **Assent-outcome closeout check.** Every user reply immediately following an assistant message that states or implies a next action requires a visible `continuing:` or `blocked:` outcome before finalizing, even if the reply is not classified as assent; every explicit continuation request does too. Missing markers never waive it. Reconcile the current request, original proposal, scope/authority changes, tool/output evidence, and remaining blockers. Respect a current explicit stop or status-only request; name that reason in the blocked outcome without executing the prior proposal. Otherwise `continuing:` must be followed by execution in the same turn; a promised next step is not execution. If part remains blocked, report its pending state and independent work performed. A status-only handoff cannot discharge an unexecuted accepted action. Repair marker formatting; for short assent, if the original proposal cannot be recovered verbatim, select `blocked:` and ask. Formatting never requires clarification. Do not silently drop an accepted action or claim a pending gate passed.

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/design-review-gate-mechanics.md

@@ -55,7 +55,7 @@ Merging triggered-work implementation on green-tests-alone, with the adversarial
 
 ## Human/team sign-off
 
-(b) human/team sign-off before implementation, merge, or launch for high-risk money/permission/data paths and for any contract/API change with an external consumer (reviewed interface diff plus compatibility decision); read-only investigation or an isolated disposable prototype that will not be merged, reused, or launched is exempt, and promoting such work to implementation reruns this gate.
+(b) This gate requires human/team sign-off before merge or launch of high-risk money/permission/data paths and breaking contract/API changes with an external consumer (reviewed interface diff plus compatibility decision). It adds no sign-off prerequisite to local, reversible implementation; explicit stricter user, repository or team rules still bind. A backward-compatible addition outside those high-risk paths needs no human sign-off under this gate; recorded deep self-review and external independent review cover it. Read-only investigation or an isolated disposable prototype that will not be merged, reused, or launched is exempt from this gate; promoting it to a merge or launch reruns the gate.
 
 ## Floor
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -99,7 +99,8 @@ At the start of the next turn, recover intent in this order:
 
 On hosts providing a current final message, `proposed-next-stop.sh` returns one bounded Stop reminder when the assistant declares a non-status `proposed-next:` action. Recheck the active request: execute a runnable, already-authorized action in the same turn; otherwise preserve explicit stop, planning-only and status-only scope, or state the concrete decision/resource/authority blocker. Missing labels with observable delivery evidence retain their formatting reminder. A status-only marker without another action declaration, quoted example, complete machine artifact, unsupported payload or host `stop_hook_active` retry does not trigger a continuation reminder.
 
-- Do not request continuation for `blocked:` with a concrete explanation or `none` with a dash-separated status explanation. Mixed status/action markers still require reconciliation.
+- A stop that waits on the user gets one bounded decision recheck instead: a `blocked:` handoff, a `none` explanation naming an approval, confirmation, decision or resource wait, or a last prose line asking permission to continue, either before any handoff label or, without a label, after observable delivery or edits. The recheck names the real blockers (missing credentials or authority; a fact unavailable from local evidence; an action the safety rules gate, such as destructive or irreversible work without recovery, production or customer data, or merge or publication outside the goal; overturning an established user direction; a material product tradeoff the evidence cannot settle) and returns security self-review, owner-skill, approach, test and naming choices and the next in-scope step to the agent. A real blocker survives it by restating `blocked:` after independent work is finished.
+- Do not request continuation for `none — status only` or another `none` status explanation, and never treat `blocked:` as a continuation request; the decision recheck above is separate. Mixed status/action markers still require reconciliation.
 
 The hook recognizes declarations, not authorization or actual task completion, and cannot force the model to follow through. OpenCode idle does not expose the required final-message evidence; its Stop behavior remains unverified.
 
@@ -113,7 +114,7 @@ Action-scoped stop conditions are: an explicit stop/pause instruction; a user-re
 
 Check continuation on every user reply immediately following assistant prose that states or implies a next action, and on any explicit continuation request, regardless of landing status. Do not first require classifying the reply as assent; visibly report the continuing or blocked outcome even when the reply changes scope or stops the proposed action. Short replies include `ok`, `yes`, `可以`, `好`, `继续`, `proceed`, `do it`, `go ahead`, and `👍`; interpret them against the recovered action rather than formatting alone.
 
-- Select `continuing: <action and scope>` when that action is clear and authorized, then execute it in the same turn. A tool call and its result or a produced artifact establish execution; the label alone does not.
+- Select `continuing: <action and scope>` when that action is clear and authorized, then execute it in the same turn. Write either outcome on its own line; a `proposed-next:` label never replaces the outcome line. A tool call and its result or a produced artifact establish execution; the label alone does not.
 - A blocked patch, review, or landing does not block every action. Keep that dependent action/claim pending while continuing available diagnosis, bounded remediation, monitoring of the existing live handle, or independent accepted work. These paths retain their own scope and permission checks; they cannot bypass the blocked gate or substitute unrelated hardening for missing evidence.
 - A failed quality gate calls for a repair that preserves its purpose. Before asking the user to choose a workaround, inspect and perform a safe structural cleanup necessary for the authorized delivery when available, including baseline failures that block it, then rerun the gate and affected tests. Follow [refactoring discipline](refactoring-discipline.md#responding-to-quality-gates): preserve behavior, compatibility and readability; do not shrink identifiers or necessary comments, weaken a baseline or rewrite history solely to make the counter pass. If no safe in-scope repair remains, report the evidence and the actual decision needed.
 - Independent work must neither depend on the pending verdict nor modify the candidate being evaluated. Name the pending gate and the independence basis when continuing. A candidate-changing fix is remediation, not independent work: let the existing run reach a terminal state, then refresh affected evidence and re-enter the owning gate. The deferred-evidence hardening prohibition still applies.
@@ -131,5 +132,5 @@ Before deriving the next slice from a status source, reconcile it against the ap
 
 Binding detail:
 
-- Internal developer self-use through already configured model/tool accounts is an ordinary execution detail: it requires no separate quota/cost disclosure, estimate, cap, or per-run confirmation.
+- Small tests and routine development/test-environment operations within the task are ordinary execution details. Use configured accounts and access directly, without per-run approval or inventing a quota/cost estimate or cap. Normal metered model/tool use is not a new purchase. Honor explicit user spending/count limits; a development/test label does not grant destructive, production, customer-data, permission-changing or new-purchase authority beyond the task.
 - Assent never replaces an owner gate's stricter authorization form and never broadens scope or implies an external purchase/financial commitment, merge, publish, destructive, production, external-message, or high-impact-decision authority.

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/review-reception.md

@@ -11,7 +11,7 @@ Use this when receiving review feedback from a human reviewer, AI reviewer, CI a
 - Push back with technical evidence when a suggestion is incorrect or harmful.
 - If your pushback was wrong, correct it factually and move on: retract only after re-verifying against the codebase or the authority that settles the point (requirement owner, product decision, observed runtime behavior) — state the concrete counter-evidence; reviewer insistence alone is never grounds, and an inconclusive re-check goes to the risk owner rather than holding the pushback — except on a scope-adding finding, which follows the mirror-case procedure below instead. Once re-verification or that risk owner establishes the pushback was wrong, retract and implement — no long apology, no defending the earlier pushback.
 - Implement one coherent review item or group at a time, then verify.
-- Partition findings before fixing: a mechanical finding (bug, missing check, wrong value) goes on the fix list; a design-level finding — one questioning a mechanism's cost, operability, trust-model fit, or existence — is a risk-owner decision item (keep / delete / narrow / replace) to surface BEFORE investing hardening rounds in the questioned mechanism. Hardening first and deciding later pays the cost twice — once to build, once to tear down. The mirror case — a finding that adds scope or abstraction beyond the agreed deliverable (a new capability or abstraction layer — not a guard, error path, or rollback that a current acceptance point or observed hard constraint already requires for behavior already in scope; a remedy that itself introduces a new capability or abstraction stays scope-adding however it is labelled; an arguable classification is settled by running the test named next, never by defaulting either way) — is never an automatic build: answer it against the structural-minimality test in `implementation-completeness-and-minimality.md` — name the current acceptance point or observed hard constraint that needs it, or state that there is none — and reply with that answer before deciding. No locator means the answer is decline, not build: building it anyway first requires the risk owner to change the governing acceptance requirement. that evidence-backed answer is the receiver's to give and the reviewer's to confirm, and a rejected answer returns the item to the receiver to rebuild the evidence rather than to a risk owner — on this question the risk owner's role is to change the governing acceptance requirement, not to override the reviewer's rejection. When one finding is both design-level and scope-adding — it questions an existing mechanism AND proposes a new capability or abstraction, whether that wraps, supplements, or replaces the mechanism — the two paths govern different objects and both run: the minimality test decides the proposed addition (receiver answers, reviewer confirms), while the questioned mechanism's keep / delete / narrow / replace stays the risk owner's. Neither substitutes for the other, and neither decision alone authorizes the addition.
+- Partition findings before fixing: a mechanical finding (bug, missing check, wrong value) goes on the fix list; a design-level finding — one questioning a mechanism's cost, operability, trust-model fit, or existence — is a risk-owner decision item (keep / delete / narrow / replace) to surface BEFORE investing hardening rounds in the questioned mechanism. Hardening first and deciding later pays the cost twice — once to build, once to tear down. In this file the risk owner is you, deciding from evidence and recording the reason; it is the user only when the decision would change accepted scope or an established user direction, or touches a money, permission, data-loss, breaking-contract or release path — never a human review or sign-off for an ordinary change. The mirror case — a finding that adds scope or abstraction beyond the agreed deliverable (a new capability or abstraction layer — not a guard, error path, or rollback that a current acceptance point or observed hard constraint already requires for behavior already in scope; a remedy that itself introduces a new capability or abstraction stays scope-adding however it is labelled; an arguable classification is settled by running the test named next, never by defaulting either way) — is never an automatic build: answer it against the structural-minimality test in `implementation-completeness-and-minimality.md` — name the current acceptance point or observed hard constraint that needs it, or state that there is none — and reply with that answer before deciding. No locator means the answer is decline, not build: building it anyway first requires the risk owner to change the governing acceptance requirement. that evidence-backed answer is the receiver's to give and the reviewer's to confirm, and a rejected answer returns the item to the receiver to rebuild the evidence rather than to a risk owner — on this question the risk owner's role is to change the governing acceptance requirement, not to override the reviewer's rejection. When one finding is both design-level and scope-adding — it questions an existing mechanism AND proposes a new capability or abstraction, whether that wraps, supplements, or replaces the mechanism — the two paths govern different objects and both run: the minimality test decides the proposed addition (receiver answers, reviewer confirms), while the questioned mechanism's keep / delete / narrow / replace stays the risk owner's. Neither substitutes for the other, and neither decision alone authorizes the addition.
 - Avoid performative agreement. Technical correctness matters more than sounding agreeable: agree only after verifying — the reply shows what you checked and what you found, and praise or thanks offered in place of that evidence is the failure ("you're absolutely right" / "great point" are the common forms).
 
 ## Response Pattern

package/dist/assets/marketplace/plugins/ccl-skills/skills/python-service-architecture/SKILL.md

@@ -133,7 +133,7 @@ Before changing architecture guidance, contracts, service boundaries, diagrams,
 - High-risk operations require a resilience contract: fail-closed policy, idempotency strategy, durable status, reconciliation or repair path, trace/request id propagation, user/support explanation surface, and proof that fallback/degradation cannot bypass authorization, tenant/user isolation, quota, audit, or data-retention controls.
 - High-risk context resolution must reject missing tenant, actor, subject, or resource scope instead of falling back to default identities. Durable side effects need atomic audit/outbox evidence or an explicit reconciliation/repair workflow.
 - Python AI/RAG service hosts must separate service wiring from inference design. Model routing, prompt policy, retrieval design, evaluation, and replay belong to `llm-inference-integration`.
-- Generated API clients and generated protobuf code are output surfaces; do not hand-edit them. Generated migrations are drafts that require human review before landing.
+- Generated API clients and generated protobuf code are output surfaces; do not hand-edit them. Generated migrations are drafts: review them before landing, and get human sign-off only before a destructive one runs on shared data.
 
 ## Reference Loading
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/SKILL.md

@@ -50,7 +50,7 @@ Turn observed experience into reusable skills without business-specific details.
   - **A retrospective over a LARGE multi-batch / multi-phase session has a second axis beyond the per-delivery chain: distinct lesson-TYPE axes that must each be covered or explicitly marked `no-new-lesson` — (a) per-artifact CONTENT lessons (the specific bug / contract value / domain rule; for research/writing/design programs this axis is the METHOD/CRAFT — how the work was done well), (b) PROGRAM/PROCESS lessons (how the multi-batch effort was structured and driven), (c) WORKFLOW/META lessons (did the retro or extraction itself recur shallow, under-trigger, or stop at the most salient content lesson), and (d) SUSTAIN lessons (what went RIGHT and how the next run reuses it — counts only with mechanism + non-luck evidence + owner routing; **axes (a)-craft and (d) read from the produced-artifact class — an enumeration driven by correction turns cannot reach them and will come back falsely empty**). Landing only the loudest content lesson and declaring the session "fully summarized / 复盘完成" is incomplete.** "LARGE" is not a vibe — it fires when the session already carries a coverage/program structure: a source register or named batch-progress standard was applied, OR the work spanned multiple explicit phases/batches/verticals. A user re-ask after a "done" claim = same-scope correction signal — classify first; never manufacture a lesson. Per-axis detail, re-ask classification, DO-CONFIRM card, `covered-through` watermark: `references/source-to-skill-extraction.md` (Task Retrospective Extraction).
   - **A long operational delivery session also needs a separate non-lesson delivery-state axis (in addition to the content/program/meta lesson axes above).** When the session changed operational delivery state across multiple repositories, branches, MRs, pipelines, releases, or deployable artifacts, the source register must carry that axis — changed artifact set, branch/worktree state, remote/MR state, CI or local verification state, cancelled/retried pipeline state, unresolved risks, and the next concrete action — before "whole-session retro complete" is claimed; closeout records either the axis rows' locator (sanitized labels in the shared landing, real per-repo evidence in scratch/private archive) or `artifact/status axis: not-applicable` with a reason. If required rows are absent, the retro can be reported only as `interim`, even when the extracted lesson text is correct. The row-family fields and closeout-evidence forms: `references/source-to-skill-extraction.md` (Task Retrospective Extraction).
 - A blocked verification item is not closed by naming the blockage. Before marking a test, device, browser, service, credential, or environment layer unavailable, attempt the normal remediation path for that layer — restart the client daemon, run the documented fallback (full rung list and sandbox-denial triage: the next ladder). Only record `unavailable` after remediation fails, with command evidence, residual risk, and the next concrete unblock action.
-  - **A landed CONCLUSION is a hypothesis until an operation that could have falsified it has been run** — both a claim that a tool / capability / lane is unavailable, impossible, or must permanently fail-closed ("fail-closed is the safe default" does not waive the in-env attempt) and a DIAGNOSIS of why an observed failure happened — a search hit proves the text EXISTS, not that it RAN on the path that failed, so run the falsifying operation first — exercise the suspected mechanism on the failing path for an observation only IT predicts, or build a paired control differing in exactly ONE variable — **only within existing sandbox/permission, non-destructive, synthetic-target, and credential-safety boundaries** (never unsafe mutation, prod/live credentials, secret-bearing state, or a permission-boundary bypass — trading this rule for the security/authority/data-loss axis). Where no safe attempt is available after remediation the record is `pending` with remediation and residual risk — never `unavailable`, `fail-closed`, or a stated cause — and an unfalsified cause is `hypothesis`, kept off shared surfaces, because withdrawing a landed cause costs more than testing it. **When REVIEWING a change that asserts impossibility/unavailability or rests on a diagnosis, independently run the same falsification attempt before accepting it** — an inherited "it can't be done" or "this is why it broke" is hypothesis-grade (see the named-convention primary-source re-verify rule). Both forms and failure shapes: `references/validation-and-landing.md` (Behavioral Validation).
+  - **A landed CONCLUSION is a hypothesis until an operation that could have falsified it has been run** — a claim that a tool / capability / lane is unavailable, impossible, or must permanently fail-closed ("fail-closed is the safe default" does not waive the in-env attempt), a DIAGNOSIS of why an observed failure happened, and a **MEASUREMENT reported as a finding about the subject** — run the falsifying operation first — exercise the suspected mechanism on the failing path for an observation only IT predicts, or build a paired control differing in exactly ONE variable — **only within existing sandbox/permission, non-destructive, synthetic-target, and credential-safety boundaries** (never unsafe mutation, prod/live credentials, secret-bearing state, or a permission-boundary bypass — trading this rule for the security/authority/data-loss axis). Where no safe attempt is available after remediation the record is `pending` with remediation and residual risk — never `unavailable`, `fail-closed`, or a stated cause — and an unfalsified cause is `hypothesis`, kept off shared surfaces, because withdrawing a landed cause costs more than testing it. **When REVIEWING a change that asserts impossibility/unavailability, rests on a diagnosis, or reports a measurement, independently run the same falsification first** — an inherited "it can't be done", "this is why it broke" or "the tool measured N" is hypothesis-grade (see the named-convention primary-source re-verify rule). Forms and failure shapes: `references/validation-and-landing.md` (Behavioral Validation).
 - A blocked source read is not closed by naming the blockage. If Figma, code, document, API, or repository reads time out, return partial output, or fail transport, switch to a smaller or different read strategy before extracting rules — and when the source is **missing rather than unreadable**, change WHERE you enumerate instead. Both ladders: `references/source-to-skill-extraction.md#blocked-verification-and-source-read-remediation`. Failed or timed-out reads do not count as coverage.
   - **Large reads can lose the middle with no reliable signal — the trigger is read-OUTPUT size, so chunk proactively.** A read whose OUTPUT exceeds ~256 lines / ~10 KiB can be silently head+tail truncated (no marker guaranteed), so a single `cat`/whole-file read does not count as coverage even when it returns no error. Whenever you need a **complete** view — whole-file coverage, a no-findings/absence claim, or a load-bearing section read — chunk it under **both ~200 lines AND ~8 KiB** and confirm a mid-file section was ingested. Detail: `references/source-to-skill-extraction.md#read-in-chunks-large-reads-lose-the-middle`.
 - Think across the full delivery lifecycle before editing: product intent, design/UX, implementation, debugging, test strategy, launch acceptance, iteration feedback, team onboarding, and normal users without source access. A rule that improves only one slice while leaving another slice ambiguous is incomplete or belongs in a narrower skill.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/eval-routing.md

@@ -61,6 +61,10 @@
 
 **地板管「能不能动手」，不等于「点估计已经准到能和阈值比」**：10 次有效观测在 70–85% 区间的抽样误差约 ±15–20 个点。实测形态（115 轮，同一个候选、同一条用例 `ab-b5`）：一次 10 副本得 5/10（50%），紧接着 20 副本得 17/20（85%），合并 22/30（73%）——单看前者会判成「稳定失败」并据以改描述，单看后者会判成「健康」。所以**任何按阈值分档的判断（稳定失败 / 边缘 / 抖动）必须读合并观测，落在约 45–75% 之间的读数在 10 副本下不构成判定**，要么补到 30 次以上，要么如实记成「区间未定」。同理，改前/改后的差值也按合并观测比：本轮那条 8/10→5/10 的「回归」在 24/30 vs 22/30 下相差两次命中，不可分。
 
+**被测模型也是测量对象的一部分，不只是评分工具**：路由由读取技能清单的那个模型决定，规则执行由运行该技能的那个模型决定；两个 runner 默认的廉价档（`claude-haiku-4-5`）只适合**筛查**候选。凡据评测结果做的技能决定——改 description、改正文规则、撤回改动、判「测不出改进」——都必须在**实际运行该技能的模型档**上测得（以 `--model` 显式指定，JSON `model_source: explicit`），合并观测地板同上；默认档的读数只能写成「候选」。runner 在落到默认档时打印 `router_model_default` / `subject_model_default` 提示。实测形态：同一组继续闸探针在默认廉价档上 10 副本读数互相矛盾，并据此撤回了一处改动；被纠正后改在部署档上重测，才得到可用于决定的基线。
+
+**被测进程必须与本机插件隔离**：`claude --print` 会加载用户级配置，包括已安装插件的 hooks——SessionStart 注入路由块、UserPromptSubmit 注入任务入口、Stop hook 可以把被评分的最终回答替换成对它自身提醒的回复。两个 runner 因此以 `--settings '{"disableAllHooks":true}'` 调用被测模型（`--bare` 同样跳过 hooks，但只接受 API key 认证）；bootstrap 只经 `--with-bootstrap` 这一受控臂进入测量。实测：未隔离时一次调用触发 12 个 hook 事件，同一档模型三次全量读数在 13/29–22/29 之间摆动，失败回答里出现了只属于 Stop 提醒的内容。隔离之前的历史读数混入了这部分上下文，不能与隔离后的读数直接比较。
+
 1. 动任何 description 之前必须先跑 **≥10 轮有效观测**的稳定性基线,把稳定失败与抖动分开;抖动不得作为修改依据(grader 超时/不可解析轮不算有效观测,须补跑)。
 2. 改后通过数必须在**最终措辞**上重测:中间稿的通过数在措辞再变的那一刻作废,不得挪用到最终候选的证据里。
 **`newly_failed` 是候选，不是回归判定。** runner 的 `--baseline` diff 在三副本下按保守共识判 status，于是一次孤立偏离就把一条用例记进 `newly_failed`；而这个集合**每跑一次就换一批**。实测（115 轮，同一条分支上四次全量三副本运行）：`{route-opencode-project-config, route-nodejs-arch}`、`{skip-pytest-cmd, ctrl-ai-risk, miss-refactor-python-unqualified, route-nodejs-arch}`、`{mem-api-log-redact, route-nodejs-arch}`——除 `route-nodejs-arch` 外每一条只出现过一次、再未复现，逐条做成对 20 副本探针后**无一可归因于该轮改动**（两例两臂分布完全相同，一例两臂都红，一例合并后相差两次命中）。所以：`newly_failed` 的每一条都要按「同一用例、改前/改后两棵树、合并 ≥20 次观测」复测才能称为回归，不得直接写进轮记录当回归清单；同样地，不得因为它每轮都有内容就把整轮判红。

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/firing-point-placement.md

@@ -20,6 +20,7 @@ For the specific owner-dispatch case, the firing point is now **mechanically enf
 
 - `owner-dispatch` PreToolUse/Stop hooks (`hooks/owner-dispatch-guard.sh`, `hooks/owner-dispatch-stop.sh`) gate the first product-code edit and session close.
 - **Subagent extension** (delegated workers are a separate firing surface — SessionStart routing is NOT inherited by subagents, so a cold worker never sees the gate): `SubagentStart` (`hooks/subagent-start.sh`) injects a slim self-gating routing pointer, and `SubagentStop` reuses `owner-dispatch-stop.sh` (PreToolUse already fires inside subagents) with `agent_id`-scoped, actor-precise markers/cap so the invoke-owner backstop applies one level down for a worker's **path-attributable** gated Edit/Write (Bash-only and missing-baseline cases stay advisory under the session Stop / CI backstop, not SubagentStop). This closes the recurrence where `multi-agent-delegation` had to *manually* inject owners into every worker prompt (`skills/multi-agent-delegation/SKILL.md` Core Rules) and the user reminded when it was forgotten.
+- **Extraction owner at the first shared-skill edit:** the default source-edit checkpoint (`hooks/skill-loading.py`) recognises a target on a ccl-skills checkout's `skills/`, `hooks/` or root `scripts/` surface (markdown included there only; the marker is probed at every such component, so a checkout under an ancestor carrying one of those names still counts; plugin-cache and `.codex` install copies excluded — the stop backstop's scope, which this round aligned) and, while `skill-extraction-workflow` is not loaded in the current context, names it and the charter-before-editing step in its one replan. Observed miss it answers: a shared-gate bug routed to its debugging owner satisfied the generic checkpoint, and the extraction backstop in `hooks/skill-extraction-gate-stop.sh` fired only at Stop, after commit, push and pull request. Limits: one replan per actor/context, Edit/Write/patch tools only (Bash-written edits still reach only the Stop backstop), and it cannot prove the charter was written.
 - `scripts/owner-dispatch/owner-dispatch.sh ci` is the host-agnostic merge backstop (engine: `scripts/owner-dispatch/owner-dispatch.sh`; rationale + safety posture: `scripts/owner-dispatch/README.md`).
 
 This is the worked example of moving an already-precise recognition-dependent gate ONTO the transition. **Honesty preserved — enforcement is partial, not total:** opt-in per product repo (`.owner-dispatch.json`), default `ask`, fail-open, Claude-hook-hard / Codex-advisory, in-session Bash-write detection is best-effort (the un-bypassable layer is CI, and only when the CI job itself is enforced), and the whole thing is a no-op on the generic Agent-Skills channel. So it raises enforcement where the plugin/hook + CI layers load, but the closeout gate + user-signal escalation remain the backstop everywhere they do not. The opt-in gap itself is now narrowed by a **closeout-acquire check** in `product-rd-workflow` (a gated multi-owner delivery whose repo lacks `.owner-dispatch.json` installs the backstop or records exempt at closeout) — so "silently absent" is caught, though still recognition-dependent at closeout, not a hard gate.